Legal
Privacy policy
What Signal 7 collects, why, who processes it, how long we keep it, and the choices you have.
1. Who we are
Signal 7 is operated by the entity named below. For the account data we collect about you, we are the controller.
Signal 7 (“Signal 7”, “we”, “us”) is a brand context platform: brands and the people who work for them keep their material, voice and direction in one place and use AI to make and publish content from it. It is reached on the web, through the Signal 7 Studio desktop app, the Signal 7 phone app, our Telegram bots, and through MCP and API keys.
Signal 7 is operated by [Legal entity name], [Registered address] ([Company / registration number]).
Controller and processor. We are the controller of the account, session, usage and billing data described here. For the material a customer’s brand or organisation puts into Signal 7 (its content, its contacts, its published pages and their visitors), the customer decides why and how it is used and we process it on the customer’s behalf, under our Terms. If your information reached us through one of our customers, that customer’s own privacy notice applies too, and you may also contact them.
Where we offer Signal 7. The Service is not currently targeted at people in the European Union or the United Kingdom, and we have not appointed a representative in either. Where the GDPR or UK GDPR applies to our processing anyway, you have the rights set out in Your controls and rights.
2. What we collect
Your account, the content you bring or make, how the product is used, your sessions and devices, payment details held by Stripe, and what you send us.
Account information
Your name, email address, password (stored only as a one-way bcrypt hash), profile picture if you add one, the brands and organisations you belong to and your role in each, and invitations you send or accept. If you sign in with Google or Telegram we receive the identifiers and profile details those services share for sign-in.
Content
What you and your team put into Signal 7 or make with it: brand briefs, documents, images, video, audio and voice memos, transcripts, prompts, chat with AI, drafts, scripts, storyboards, published pieces, and material imported from connected services (for example a WordPress site, a Shopify store, a social account, or files you send to our Telegram bot). We also store derived data computed from your content to make the product work, such as transcriptions, colour and style measurements, and embeddings (numeric fingerprints used for search and “more like this”).
Connected accounts and keys
When you connect a service (a social network, an ad account, WordPress, Shopify, Google Drive) we store the access tokens it issues so we can act on your instruction. When a brand adds its own AI provider key (BYOK) we store that key. Both are encrypted at rest; see Security.
Usage and product analytics
Which parts of the product are used, when, for how long, and whether an action succeeded: counts and timings, never the content itself. We also keep a ledger of AI calls (which model, how many tokens, the cost, and whether your key or ours paid) for billing and spend caps. By default we record which rooms you open and for how long; you can choose Essential in Settings to keep only what the platform must keep to work and to be accountable. If your browser sends Do Not Track, we treat it as Essential.
Sessions, devices and your IP address
When you sign in — on the web, the phone app, Signal 7 Studio, through an MCP key or by linking Telegram — we record that session: how you signed in, your IP address (IPv4 or IPv6) and every change of address during the session, the approximate location we derive from it (country, region, city, postal area, timezone), your network operator and whether the network looks like a VPN, proxy, hosting provider or Tor, your device and browser details (browser and operating system with versions, device model where your browser or app reports it, screen size, language, timezone, pointer type, processor count, memory and connection type), the app version and machine name for our desktop and phone apps, the page that brought you to us, and your session activity (the pages and actions within the session). We do not use canvas, font or other fingerprinting, and we do not track you across other sites.
Approximate location comes from an IP database we hold ourselves; your address is not sent to a location service. IP geolocation by DB-IP (https://db-ip.com), CC BY 4.0. db-ip.com
Payment information
Paid plans are billed through Stripe. Card details are entered on Stripe’s pages and held by Stripe; we receive and keep the customer and subscription identifiers, plan, billing status, invoices and the last details Stripe shares for display (such as card brand and last four digits).
Communications
Messages you send us (email, feedback reported from inside the product, support requests), messages you send our Telegram bots, and the record of email we send you (delivered, opened or bounced, as reported by our email provider).
Information about people who are not users
Customers may store contacts, leads, form submissions and visitor counts for their own sites and campaigns in Signal 7. We process that data for the customer, under their instruction.
3. How we use it, and why
To run the service you asked for, to keep it secure, to bill for it, and to improve it. We do not sell personal data.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Provide the service: accounts, brands, storage, AI generation, publishing on your instruction | Account, content, connected accounts, keys | Contract |
| Security and fraud prevention: recognising devices, alerting you to unusual sign-ins, blocking abuse | Sessions, devices, IP address, failed sign-ins | Legitimate interests (keeping accounts and the service safe) |
| Usage metering, spend caps and billing | AI usage ledger, plan, Stripe records | Contract; legal obligation for tax records |
| Moderating AI output before it is published to people who did not write it | The output text | Legitimate interests; the customer’s instruction |
| Improving the product | Usage counts and timings (Full tier only) | Legitimate interests; you can choose Essential |
| Service and security messages | Email, Telegram, in-app notices | Contract; legitimate interests |
| Product news and the waitlist | Email address | Consent, withdrawable at any time |
We do not sell or rent personal data, and we do not share it for cross-context behavioural advertising.
Your content is processed to provide the features you ask for. Where a feature uses AI, the content it needs is sent to the AI providers listed in Who processes it for that purpose; see AI providers and your own keys.
Automated processing. AI produces drafts and suggestions; a person decides what to publish unless a brand has switched on automatic publishing for itself (it is off by default). We do not make decisions with legal or similarly significant effects about you solely by automated means.
4. AI providers and your own keys
To generate, your prompt and the brand context it needs are sent to an AI provider. If your brand added its own key, that provider account is used first.
When you ask Signal 7 to write, analyse, transcribe, translate or generate, the request and the brand context it needs are sent to one of the providers below through its API. Which provider handles a task depends on the task and on your brand’s model settings, which can deny a model or a price tier. Each provider handles what it receives under its own API terms.
Bring your own key. If your brand has added its own key for a provider, requests to that provider run on your key and under your own agreement with that provider; otherwise they run on our account. Our usage ledger records which key paid for each call.
Moderation. Where AI output is about to leave Signal 7 for people who did not write it (a public chat reply, a published piece, an external step in a flow), the text is checked first with OpenAI’s moderation service. Depending on your brand’s setting the result is recorded, or the output is blocked.
5. Who processes it
A small set of service providers run parts of Signal 7 for us. Each receives only what its job needs.
| Provider | What it does for us | Data it handles |
|---|---|---|
| Anthropic | AI models (Claude) | Prompts, brand context, outputs |
| OpenAI | AI models, image generation, output moderation | Prompts, brand context, outputs |
| xAI | AI models (Grok) | Prompts, brand context, outputs |
| AI models (Gemini); Google sign-in and Drive, when you use them | Prompts, outputs; sign-in identity; files you choose | |
| ElevenLabs | Voice transcription and speech | Audio and voice memos, transcripts |
| Runway, Meshy, Firecrawl | Video, 3D and web-capture tools, only when you invoke them | The inputs you give that tool |
| Railway | Application hosting | All service data in transit and in processing |
| MongoDB (Atlas) | Primary database | Account, content records, sessions, usage |
| Cloudflare | DNS, network, and R2 file storage for media | Uploaded and generated files; request metadata |
| Pinecone | Vector search for brand memory, where enabled | Embeddings and short references |
| Stripe | Payments and subscriptions | Billing contact, payment details, invoices |
| Resend | Transactional email | Email address, message content |
| Telegram | Our bots, if you use them | Messages and files you send the bots; your Telegram ID |
| Sentry | Error monitoring | Error reports, which may include request metadata |
Connected services (social networks, ad platforms, WordPress, Shopify) receive what you tell Signal 7 to send them, and their own terms and privacy policies apply. DB-IP is not a processor: we download its database and look addresses up on our own servers.
We may update this list as the service changes; material changes are announced as described in Changes.
6. International transfers
Our providers operate in the United States and elsewhere, so your data may be processed outside your country.
Signal 7 and most of the providers above process data in the United States, and may process it in other countries where they operate. Where the law of your country (for example the EU, EEA, UK or Switzerland) restricts transfers, we rely on the safeguards available to us, such as the European Commission’s Standard Contractual Clauses, the UK Addendum, and providers’ certifications under the EU–US Data Privacy Framework where they hold one. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
Account data and content for as long as your account exists. Full IP addresses and session detail for 12 months, then only country and network operator.
| Data | How long |
|---|---|
| Account information | While your account exists; deleted within 30 days of a deletion request, except what the law requires us to keep |
| Content and connected-account tokens | Until you or your brand deletes it, or the account is closed |
| Session detail: full IP address, approximate location, network, device and activity | 12 months from the start of the session |
| Reduced session record: country and network operator only | While your account exists, to count sessions by place over time; a fixed limit is being set |
| Usage counts and timings | While the account exists, as aggregate counts |
| AI usage ledger and billing records | As long as tax and accounting law requires |
| Agent trail (the audit record of what agents did on your behalf) | While the brand exists; it cannot be edited |
| Backups | Database backups are taken daily and each is kept for 30 days. Data you delete may remain in those backups for up to 30 days before it is overwritten, so a deletion request completes within 30 days and leaves the backups within a further 30 days |
We keep your sessions' full IP address, approximate location, network, device details and activity for 12 months, then reduce each to its country and network operator only. A daily job enforces this.
8. Your controls and rights
See and end your sessions yourself; choose Essential telemetry; ask us to access, correct, export or delete your data, or to stop a use you object to.
In the product. You can see every session and device on your account — with its device, app, location, IP address and network — on your Usage page and in Settings, and end any of them with “End session” or “Sign out everywhere else”, which revokes that session’s tokens and any paired device. You can switch telemetry to Essential in Settings. Administrators of a brand or organisation see totals for their scope, not your IP address.
By request. Email privacy@signal7.io to access a copy of your data, correct it, export it in a portable format, delete it, restrict or object to a use (including our legitimate-interest uses), or withdraw a consent. We will confirm who you are before acting, and answer within one month (GDPR) or 45 days (US state laws), telling you if we need longer.
EU, EEA and UK. Where the GDPR or UK GDPR applies, you have the rights above under it, and the right to complain to your data protection authority.
California and other US states. Under the CCPA/CPRA and similar laws you may know, access, correct and delete personal information, and opt out of its sale or sharing. We do not sell or share personal information as those laws define it, and we do not use sensitive personal information to infer characteristics about you. We will not treat you differently for using these rights. An authorised agent may make a request for you with your written permission.
If your data reached us through a customer’s brand, we may pass your request to that customer, who decides on it.
10. Children
Signal 7 is a professional tool and not for children.
Signal 7 is not directed at children and you must be at least 18 to use it. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
11. Security
Encryption in transit and for stored secrets, access checked on the server, alerts on unusual sign-ins, and an audit trail of agent actions.
We protect data with encryption in transit, AES-256-GCM encryption for stored keys and access tokens, access control checked on the server for every request, alerts on unusual sign-ins, and an append-only record of what agents did on your behalf. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the authorities as the law requires. The detail is on our Security page.
12. Changes to this policy
We will date every change and tell you in advance about material ones.
We will post any change on this page with a new “Last updated” date. If a change is material, we will tell you by email or in the product at least 30 days before it takes effect, and ask for consent where the law requires it.
13. Contact
Write to us about anything in this policy.
Privacy questions and requests: privacy@signal7.io. Post: [Legal entity name], [Registered address].